Raised 2026-06-20 in the Q2 2026 internal audit baseline. 11 critical findings on internet-facing AWS workloads were open beyond the 15-day SLA at the end of May.

Applications: Amazon Web Services (ap-south-1), GitHub Enterprise Cloud.

Potential risk

Unauthorised or erroneous transactions could go undetected and expose Meridian to financial loss and regulatory action.

Root cause

Container base images were not rebuilt on a schedule.

Agreed action plan

Remediate: critical vulnerabilities past remediation sla.

Management response: Management agreed and committed to remediate before the Q3 review.

Action: REM-F-IAQ2-VUL-01
Owner (FPR): Ananya Rao
Target date: 31 Jul 2026
Priority: High
Status: Closed
Validation: Pending · planned 20 Oct 2026

Evidence for this control (2)

Open list →

Evidence	Title	Control	Source system	Collected	Status
Q2-EV-022	Amazon Web Services (ap-south-1) · configuration report (Q2)	VUL-01	Amazon Web Services (ap-south-1)	17 Jun 2026	Rejected
Q2-EV-023	GitHub Enterprise Cloud · ticket sample (Q2)	VUL-01	GitHub Enterprise Cloud	22 Jun 2026	Rejected

Tests of this control (1)

Open list →

Test	Control	Cycle	Tested	By	Result	Confidence
TST-Q2-VUL-01	VUL-01 · Vulnerabilities are scanned and remediated within SLA	Q2 2026 Unified Program Review	18 Jun 2026	Farah Khan, Vikram Mehta · Meridian Internal Audit	Fail	High